CVE-2026-62677
Received Received - Intake

Path Traversal in Omnigent AI Agent Framework

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-62677
EUVD
EUVD-2026-64015

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
omnigent-ai omnigent 0.3.0
omnigent omnigent 0.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Omnigent allows an authenticated user to upload a malicious agent bundle with a crafted os_env.cwd path pointing to arbitrary host directories. The system fails to validate or normalize this path, enabling the attacker to bypass workspace boundaries. When OMNIGENT_RUNNER_WORKSPACE is unset, the runner uses this attacker-controlled path as the environment root, allowing file read/write, shell execution, and access to runner secrets outside the intended workspace.

Detection Guidance

Check for agent bundles with absolute or traversal paths in os_env.cwd by inspecting uploaded config.yaml files. Look for paths starting with / or containing .. in the cwd field. Verify if OMNIGENT_RUNNER_WORKSPACE is set on runners. Monitor filesystem access patterns by agents outside expected directories.

Impact Analysis

An attacker could access sensitive files on the host system, modify or delete critical files, execute arbitrary commands, or steal environment secrets. This includes reading configuration files, accessing user data, or compromising the entire system if the runner has elevated privileges. The impact is severe due to the combination of filesystem access and secret exposure.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. It enables unauthorized access to sensitive data, which could result in data breaches under GDPR (unauthorized access to personal data) and HIPAA (unauthorized access to protected health information). Organizations using Omnigent may face regulatory penalties and must address this issue to maintain compliance.

Mitigation Strategies

Upgrade to Omnigent version 0.3.0 or later. Ensure OMNIGENT_RUNNER_WORKSPACE is set on all runners to restrict agent workspace. Validate agent bundles to reject absolute or traversal paths in os_env.cwd during upload. Extend validation to terminal-specific os_env.cwd fields in bundles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart